SINGAPORE — November 4, 2026
Singapore Airlines (SIA) has confirmed that approximately 46,000 booking records were accessed without authorisation following a cybersecurity incident involving Amadeus, a third-party travel technology provider that supports some of the airline’s reservation and booking processes.
The incident has raised concerns among travellers because the information accessed included passenger names, booking reference numbers, travel itineraries and booking classes.
For approximately 620 booking records, additional personal information — including email addresses, phone numbers, travel document details and KrisFlyer membership numbers — may also have been accessed.
However, SIA has stressed that its own information technology systems were not breached. The incident was confined to Amadeus’ platform, and the technology provider has confirmed that bank account and credit card information were not exposed.
The airline also said there was no unauthorised modification of bookings.
SIA is contacting affected customers with upcoming travel as a precaution and changing their booking reference numbers. It has also informed the relevant authorities and apologised to customers affected by the incident.
What Information Was Accessed?
The breach involved approximately 46,000 SIA booking records, although the airline has not described this figure as the number of individual passengers affected.
According to information provided by SIA, the data accessed included:
- Customers’ names
- Booking reference numbers
- Travel itineraries
- Booking classes
For approximately 620 records, the information may also have included:
- Email addresses
- Phone numbers
- Travel document details
- KrisFlyer membership numbers
The additional information is particularly important because it involves details that could make communications directed at affected travellers appear more convincing.
Nevertheless, SIA said Amadeus confirmed that bank account and credit card information were not exposed. The airline also reported that the unauthorised access did not result in changes to existing bookings.
SIA Says Its Own Systems Were Not Breached
One important distinction in the incident is where the unauthorised access occurred.
Amadeus is a global travel technology company that provides systems supporting airline reservations and other travel-related processes. SIA uses its platform for certain booking and reservation functions.
The airline said the incident was confined to Amadeus’ platform and did not involve a breach of Singapore Airlines’ own IT systems.
Amadeus informed SIA that it had implemented containment measures and additional security safeguards following the incident.
The distinction does not make the exposure insignificant. Even when an organisation’s internal systems remain unaffected, customer information entrusted to an external technology provider can still be exposed through that provider’s systems.
SIA said it had informed the relevant authorities and was working with Amadeus following the discovery.
Why SIA Is Changing Booking Reference Numbers
SIA is directly contacting affected customers who have upcoming travel to arrange changes to their booking reference numbers.
The precaution is significant because booking references are used by passengers to retrieve and manage their reservations.
Replacing the affected references helps reduce the risk associated with the exposure of those booking details.
Customers should distinguish between genuine airline communications and unsolicited messages claiming that a booking needs to be changed. Because the airline is actually contacting affected travellers, fraudulent messages could potentially imitate the same process.
Travellers should verify any unexpected request through Singapore Airlines’ official website or customer-service channels rather than relying solely on links or contact details contained in an unsolicited message.
The airline has not publicly disclosed how many affected customers have already been contacted or when the notification process will be completed.
Amadeus Says It Identified a Vulnerability in a Booking Environment
The incident is not limited to Singapore Airlines.
In an October statement, Amadeus said it had become aware of a vulnerability affecting a travel booking display environment, through which certain booking information was available.
The company said it had taken steps to address the vulnerability and strengthen its monitoring and detection capabilities.
Amadeus also said its investigation was continuing. At the time of its statement, it reported no evidence that payment or financial data had been accessed and no indication that the vulnerability had been exploited for ransomware purposes.
The precise technical details of the vulnerability and the identity of the unauthorised third party have not been publicly established in the reports available.
Other Major Airlines Have Also Reported Exposure
Singapore Airlines is among several international carriers that have disclosed customer-data exposure connected to the Amadeus incident.
The airlines have reported different figures and categories of affected information.
Cathay Pacific said approximately 53,000 bookings were affected. Japan Airlines previously reported that information belonging to approximately 92,000 customers had been compromised.
Malaysia Airlines, Korean Air and Asiana Airlines have also reported that customer information may have been affected.
The disclosures illustrate how a cybersecurity incident involving a shared technology provider can affect multiple airlines operating in different countries.
For passengers, the consequences may vary depending on which airline they booked with and what information was held in the affected records.
Malaysia Airlines Also Warns Customers About the Incident
Malaysia Airlines disclosed on Nov. 1 that some customer information may have been exposed through the cybersecurity incident involving Amadeus.
The carrier said its own IT systems had not been compromised and that there was no evidence that financial information had been accessed.
It urged customers to remain alert to suspicious or unsolicited communications, particularly messages requesting personal or financial details.
The airline also said it was working with Amadeus and relevant parties to investigate the incident and assess its impact.
Why Third-Party Data Breaches Are Becoming a Bigger Concern
The SIA incident highlights a growing challenge for companies that rely on external technology providers to manage customer information.
Airlines depend on interconnected systems to handle reservations, passenger details and travel-related services. These arrangements can make operations more efficient, but they also mean that customer information may be processed and stored outside an airline’s own IT environment.
A security weakness at one provider can therefore affect several organisations that rely on its services.
The same concern has appeared in other industries. Singapore’s healthcare and insurance sector, for example, faced a separate data breach involving Alliance Medinet, in which information belonging to approximately 110,000 members was reported compromised.
Aviation companies have also faced cybersecurity incidents involving their own systems. Taiwan’s EVA Air and Evergreen Aviation Technologies previously disclosed separate cyber incidents, highlighting the range of digital security challenges confronting the aviation industry.
These incidents are not established to be connected. They nevertheless demonstrate why organisations must consider the security of their suppliers and service providers alongside their own internal systems.
What Should Singapore Airlines Customers Do?
SIA has said it is contacting affected customers with upcoming travel to change their booking reference numbers.
Travellers who receive a message claiming to be from the airline should verify it independently before sharing personal information or taking action.
Customers can take several sensible precautions:
- Check booking information through the official Singapore Airlines website or mobile application.
- Be cautious about unexpected messages requesting personal, travel-document or financial information.
- Avoid opening suspicious links or attachments.
- Do not disclose passwords or one-time verification codes in response to unsolicited requests.
- Contact the airline through official customer-service channels if a notification appears unusual.
These precautions are relevant even though SIA has said bank account and credit card information were not exposed.
The reported exposure of booking references and travel itineraries can still make fraudulent communications more convincing.
Important Questions Remain About the Breach
Although SIA has disclosed the approximate number of affected booking records and the categories of information involved, several details remain unclear.
The airline has not publicly identified the unauthorised third party, explained precisely how the vulnerability was exploited or provided a complete account of when the affected SIA records were accessed.
It has also not disclosed how many unique passengers are represented by the approximately 46,000 booking records.
Amadeus’ investigation remains ongoing, and further information may emerge as the company and affected airlines complete their assessments.
For now, the confirmed position is that information from approximately 46,000 SIA booking records was accessed through Amadeus’ platform, while additional personal details may have been involved in around 620 records.
SIA says its own IT systems were not breached, financial account and card information were not exposed, and bookings were not modified.
The incident is a reminder that protecting passenger information requires more than securing an airline’s own network. It also depends on the security of the external systems entrusted with handling customers’ travel details.
